Meet your partner's standard
Banks and licensed partners will audit your onboarding. Your KYC has to meet their policy, not just your own.
Financial services
Financial services / Fintechs
Your licence decides your rules. Your partners decide how hard they are enforced.
Kenyan fintechs sit under whichever regulator covers the activity: the CBK for payments, remittance and credit, the Capital Markets Authority for investment products and its regulatory sandbox, the Insurance Regulatory Authority for insurtech. Partner banks and investors run their own due diligence on top.
At a glance
Who sets the rules?
Primary regulator
CBK, CMA and other sector regulators
Who this covers
Payments, wealth, insurtech, remittance, crypto and embedded-finance companies, whether licensed directly or operating through a licensed partner.
Regulations that apply
Sector licensing (CBK, CMA, IRA)
The activity you carry out determines the licence and the customer due-diligence standard that comes with it.
Virtual Asset Service Providers Act, 2025
Brings crypto exchanges, wallets and other virtual-asset businesses under licensing, with AML obligations aligned to FATF standards.
POCAMLA, 2009
Applies to fintechs that are reporting institutions, and indirectly to those whose partner bank passes the obligation down by contract.
Data Protection Act, 2019
Registration with the ODPC, consent and purpose limits, and safeguards for transfers of identity data outside Kenya.
Computer Misuse and Cybercrimes Act, 2018
Offences covering identity theft, impersonation and computer fraud that onboarding controls are designed to stop.
What you have to do
Know your merchants
Verify the businesses you onboard and the people who own and control them.
Prove your controls
Show regulators, partners and investors how decisions are made, by whom, and on what evidence.
Protect the data
Collect only what you need, keep it only as long as required, and document where it is processed.
Fraud to watch for
Synthetic identities at scale
Automated sign-ups built from stolen and AI-generated identity data.
Front merchants
Shell businesses onboarded to launder funds or run payment fraud.
Account takeover
SIM swap and social engineering used to take over verified accounts.
How Sentinel helps
- KYC and KYB through one API, so onboarding scales without lowering the bar.
- Configurable review rules to match your partner bank's policy.
- Audit-ready records you can share with partners and examiners.
Related reading
23 October 2026 · 5 min read
Kenya and the FATF grey list: what it means for onboarding
Why increased monitoring raises the bar for customer due diligence at banks, SACCOs, PSPs and fintechs, and what a defensible onboarding record looks like.
Read the article 23 October 2026 · 4 min readDigital lenders in Kenya: identity, licensing and data protection
Lending apps now sit under CBK licensing and active data protection enforcement. Here is what that means for identity checks in the loan flow.
Read the article 23 October 2026 · 4 min readDeepfakes and remote onboarding: what a liveness check has to prove
Face-swap video and replay attacks are now cheap. What institutions should expect from liveness and document checks, and why the record matters as much as the result.
Read the articleGeneral information, not legal advice. Last reviewed October 2026. Requirements change, so confirm the current position with the regulator or your counsel before relying on it.